I didn't search on the C2 domain itself. I searched on the POST path, since there were over 4k domains (according to Wandera) that were involved in this. This was just the first sample I cam across. Most of the other C2's I've found have the same structure charge.*.com.

Thanks :) I can send you the sample if you'd like. I plan on posting some additional hashes today (Without help from @wandera may I add) that appear to also be #RedDrop. I searched on the URL path from the screenshot in their blog.